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DETAILED ACTION 

Claims 1-39 have been considered. 

Continued Examination Under 37 CFR 1.114 

5 A request for continued examination under 37 CFR 1.1 14, including the fee set forth in 37 CFR 

1.17(e), was filed in this application after final rejection. Since this application is eligible for continued 
examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the 
finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114, Applicant's 
submission filed on 11/17/05 has been entered. 

10 

Specification 

The Specification is objected to in accordance with the 112, first paragraph, written description 
requirement below. 

1 5 Claim Rejections - 35 (JSC §112 

The following is a quotation of the first paragraph of 35 U.S.C. 112: 

The specification shall contain a written description of the invention, and of the manner and process of 
making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the 
art to which it pertains, or with which it is most nearly connected, to make and use the same and shall 
20 set forth the best mode contemplated by the inventor of carrying out his invention. 

Claims 1-39 are rejected under 35 U.S.C. 112, first paragraph, as failing to comply with the 
written description requirement. The claim(s) contains subject matter which was not described in the 
25 specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor(s), 
at the time the application was filed, had possession of the claimed invention. 

Examiner finds no disclosure of "exchanging identification data with a remote computer system" 
and "determining, based on the identification data, whether a predefined security policy exists 
corresponding to the remote computer system" (see claims 1,14, and 27). Specifically, Examiner finds no 
30 mention of determining whether a predefined security policy exists corresponding to the remote computer 
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system based on identification data exchanged with a remote computer system. Appropriate correction 
or a specific reference as to where the above limitations are disclosed in the Specification is required. 

Further, Examiner finds no disclosure of "selecting a security policy specification format capable 
of being utilized by a plurality of different operating systems and a plurality of different machine types if a 
5 predefined security policy is absent" (see claims 1,14, and 27) or "automatically configuring an IP 
security tunnel between the data processing system and the remote computer system utilizing said 
security policy specification format" (claims 14 and 27). 

As best understood by Examiner, applicant teaches the creation of a tunnel using VPN 
configuration data. A local-remote pair is selected from an endpoints table (410 of Fig 4). If the pair is 
10 found, a policy is selected from a policy table if found (460 of Fig 4) or a default policy is used (455 of Fig 
4). If the pair is not found, an error is returned declaring that a user needs to configure a tunnel (425 of 
Fig 4). Nowhere in the above description or the Specification as a whole does the Examiner find support 
for the newly added claim limitations. Appropriate correction or a specific reference to where the instant 
claimed invention is disclosed in the Specification is required. 

15 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

20 

Claims 2-4,15, and 28-30 are rejected under 35 U.S.C. 112, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which applicant regards 
as the invention. In claim 2, Applicant has referred to "said security policy specification format" in part b. 
It is unclear whether this reference is to the "security policy specification format" mentioned in part a of 
25 claim 2 or the "security policy specification format" mentioned in claim 1. Appropriate correction is 
required. 
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Claims 16-17 recite the limitation "said DTD file". There is insufficient antecedent basis for this 
limitation in the claim. 

Claims 14-39 recites the limitation "said data processing system" in claims 14 and 27. There is 
5 insufficient antecedent basis for this limitation in the claim. 

Claim Rejections - 35 USC §102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for 

the rejections under this section made in this Office action: 

10 A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), 
by another filed in the United States before the invention by the applicant for patent or (2) a 
patent granted on an application for patent by another filed in the United States before the 
invention by the applicant for patent, except that an international application filed under the treaty 
15 defined in section 351(a) shall have the effects for purposes of this subsection of an application 

filed in the United States only if the international application designated the United States and 
was published under Article 21 (2) of such treaty in the English language. 

20 Claims 1,5-14,18-27, and 31-39 are rejected under 35 U.S.C, 102(e) as being anticipated by 

D'Sa, U.S. Patent Application Publication No. 2002/0178355. 

As per claims 1,14, and 27, the applicant describes a data processing system for defining a 
configuration of IP security tunnels comprising the following limitations which are met by D'Sa: 
25 a) exchanging identification data with a remote computer system ([0041],[0047]-[0048],Fig2); 

b) determining, based on the identification data, whether a predefined security policy exists 
corresponding to the remote computer system (([0041],[0047]-[0048],Fig2); 

c) selecting a security policy specification format capable of being utilized by a plurality of 
different operating systems and a plurality of different machine types if a predefined security policy is 

30 absent ([0041],[0047J-[0048] ) Fig 2); 
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d) said system for automatically configuring an IP security tunnel between the data processing 
system and the remote computer system utilizing said security policy specification format ([0042], [0047]- 
[0048J,Fig 2). 

As per claims 5-11,18-24, and 31-37, the applicant describes the system of claims 1,14, and 27, 
which are met by D'Sa (see above), with the following limitations which are met by D'Sa: 

a) a root element ([0070]); 

b) a protection element ([0099]); 

c) a transform element ([0090], [0153]); 

d) a group element ([0065]); 

e) an identification element ([0066]); 

f) a tunnel element ([0138], [0139], [0177]); 

g) a local/remote identify element ([0058], [0061]); 

h) an ID type element ([0066]); 

i) an ID definition element ([0067]); 

j) a pre-shared key element ([0099]); 
k) an IPsec proposal element ([0071], [0072]); 
I) an IPsec authentication header element ([0146]); 
m) an IPsec protection element ([0146]); 

As per claims 12-13,25-26, and 38-39, the applicant describes the system of claims 1,14, and 27, 
which are met by D'Sa (see above), with the following limitation which is met by D'Sa: 

Further comprising the step of automatically configuring an IP security tunnel utilizing said 
security policy specification format ([0040] and [0041]); 

Claims 1,14, and 27 are rejected under 35 U.S.C. 102(e) as being anticipated by Bendinelli, U.S. 
Patent No. 6,631,416. 
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As per claims 1,14, and 27, the applicant describes a data processing system for defining a 
configuration of IP security tunnels with the following limitations which are met by Bendineili: 

a) exchanging identification data with a remote computer system (Col 17, lines 21-65; Col 10, line 
5 60 to Col 11, line 8); 

b) determining, based on the identification data, whether a predefined security policy exists 
corresponding to the remote computer system (Col 17, lines 21-65; Col 10, line 60 to Col 11, line 8); 

c) selecting a security policy specification format capable of being utilized by a plurality of 
different operating systems and a plurality of different machine types if a predefined security policy is 

10 absent (Col 17, lines 36-63); 

d) said system for automatically configuring an IP security tunnel between the data processing 
system and the remote computer system utilizing said security policy specification format (Col 17, lines 
36-63). 

1 5 Claim Rejections - 35 USC §103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 

rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as 
set forth in section 102 of this title, if the differences between the subject matter sought to be 
20 patented and the prior art are such that the subject matter as a whole would have been obvious 

at the time the invention was made to a person having ordinary skill in the art to which said 
subject matter pertains. Patentability shall not be negatived by the manner in which the invention 
was made. 

25 

Claims 2-4,15-17, and 28-30 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Bendineili in view of Pfeiffer (Pfeiffer, Ralf I. March 2, 1999. XML Tutorials for Programmers, retrieved 
from http://www.informatik.hu-berlin.de/-xinq/Lib/RIP-writinq.pdf ). 
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As per claims 2-4,15-17, and 28-30, the applicant describes the system of claims 1,14, and 27, 
which are met by Bendinelli (see above), with the following limitations which are met by Bendinelli in view 
of Pfeiffer: 

a) Establishing a security policy specification format capable of being utilized by a plurality of 
5 different operating systems and a plurality of different machine types (Bendinelli: Col 17, lines 36-63); 

b) Establishing said security policy specification format being established as a DTD file 
(Bendinelli: Col 17, lines 36-63; Pfeiffer: pages 5-6); 

Bendinelli discloses all the limitations of independent claims 1,14, and 27. However, Bendinelli 
discloses that the security policy specification format is established as an XML file, not a DTD file. Pfeiffer 
10 discloses that a DTD file commonly stores policy and rules. Combining Pfeiffer with Bendinelli would 
allow the security policy specification format to be stored in a DTD file instead of an XML file. It would 
have been obvious to one of ordinary skill in the art at the time the invention was filed to incorporate the 
ideas of Pfeiffer with those of Bendinelli because a DTD file is another means to store a security policy 
specification format and DTD files typically store policy and rules. 

15 

Response to Arguments 

Applicant's arguments with respect to the 102(e) rejection of claim 1 under D'Sa have been fully 
considered but they are not persuasive. Applicant argues, substantially, that D'Sa does not teach the 
following: 

20 a) a security policy specification format capable of being utilized by a plurality of different 

operating systems and a plurality of machine types 

b) defining a configuration of an IP security tunnel utilizing said security policy specification format 
Examiner notes that both (a) and (b) were addressed in the previous action (see final action, 
mailed 8/23/05, page 6, line 6 to page 7, line 15). It appears that applicant has reiterated substantially the 
25 same argument as presented in the previous Remarks (see Remarks filed 7/20/05) without addressing 
Examiner's comments. 
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Applicant's arguments with respect to the 102(e) rejection of claims 6,11-13,16,24-26,29,37-39, 
and 39 under D'Sa have been fully considered but they are not persuasive. It appears that applicant has 
reiterated substantially the same argument as presented in the previous Remarks (see Remarks filed 
7/20/05) without addressing Examiner's comments. 

5 

Applicant's arguments with respect to the 102(e) rejection of claims 1,14, and 27 under Bendinelli 
have been fully considered but they are not persuasive. It appears that applicant has reiterated 
substantially the same argument as presented in the previous Remarks (see Remarks filed 7/20/05) 
without addressing Examiner's comments. 
10 Applicant further alleges that Bendinelli does not teach "exchanging identification data with a 

remote computer system" and "determining whether a predefined security policy exists corresponding to 
the remote computer system" (see Remarks page 11). Examiner respectfully disagrees, and notes that 
the claim limitations are found at least in the newly cited passages for these limitations (See Col 17, lines 
21-65 and Col 10 line 60 to Col 11, line 8). Accordingly, the rejection has been maintained. 

15 

Applicant's arguments with respect to the 103(a) rejection of claim 2 under Bendinelli in view of 
Pfieffer has been fully considered but they are not persuasive. The applicant argues motivation and 
hindsight. Such an argument is not persuasive on any level. 

It is respectfully submitted that the test for obviousness is not whether the features of a secondary 

20 reference may be bodily incorporated into the structure of the primary reference; nor is it that the claimed 
invention must be expressly suggested in any one or all of the references. Rather, the test is what the 
combined teachings of the references would have suggested to those of ordinary skill in the art. See In re 
Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981). Furthermore, artisans must be presumed to know 
something about the art apart from what the references disclose. In re Jacoby, 309 F.2d 738, 226 USPQ 

25 317 (CCPA 1962). The conclusion of obviousness may be made from common knowledge and common 
sense of a person of ordinary skill in the art without any specific hint or suggestion in a particular 
reference. In re Bozek, 416 F. 2d 738, 1385 USPQ 545 (CCPA 1969) and In re Nilssen, 851 F. 2d 1401- 
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1403, 7 USPQ 2d 1500-1502 (Fed. Cir. 1990). Every reference relies to some extent on knowledge of 
persons skilled in the art to complement that which is disclosed therein. In re Bode, 550 F.2d 656, 193 
USPQ 545 (CCPA 1977). 

In the instant case, there is motivation to store the security policy specification format in a DTD 
5 file instead of an XML file because a DTD file is a common means of storing a format, such as a security 
policy specification format, and it is well-known that a DTD file typically stores policy and rules. 

In response to applicant's argument that the examiner's conclusion of obviousness is based upon 
improper hindsight reasoning, it must be recognized that any judgment on obviousness is in a sense 
necessarily a reconstruction based upon hindsight reasoning. But so long as it takes into account only 
1 0 knowledge which was within the level of ordinary skill at the time the claimed invention was made, and 
does not include knowledge gleaned only from the applicant's disclosure, such a reconstruction is proper. 
See In re McLaughlin, 443 F.2d 1392, 170 USPQ 209 (CCPA 1971). 



Any inquiry concerning this communication or earlier communications from the examiner should 
be directed to Kevin Schubert whose telephone number is (571) 272-4239. The examiner can normally 
be reached on M-F 7:30-6:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, 
20 Emmanuel Moise can be reached on (571) 272-3865. The fax phone number for the organization where 
this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent Application 
Information Retrieval (PAIR) system. Status information for published applications may be obtained from 
either Private PAIR or Public PAIR. Status information for unpublished applications is available through 
25 Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) 
at 866-217-9197 (toll-free). y 



Conclusion 



15 



This action is made non-final. 




